Mailing-List: contact user-help@hbase.apache.org; run by ezmlm
Precedence: bulk
Reply-To: user@hbase.apache.org
Received-SPF: pass (nike.apache.org: domain of anilgupta84@gmail.com
 designates 209.85.192.45 as permitted sender)
MIME-Version: 1.0
In-Reply-To: 
 <CAH76=OJODm4E8YyfQBznSyqLq8ve5UTQu2jPG-45Tf=UW+7Y6A@mail.gmail.com>
References: <tencent_A55454FAC719EA06A889247B@qq.com>
 <CAH76=OLaRjsJdhbJW+pn24X5L8fJZoccRFU8WHoffeqymq7Xig@mail.gmail.com>
 <CADfYSXS7DKij+fS5PN6Yu3n83TvHHLpphZkVbMSCNiGuSAkodg@mail.gmail.com>
 <CAH76=OJODm4E8YyfQBznSyqLq8ve5UTQu2jPG-45Tf=UW+7Y6A@mail.gmail.com>
From: anil gupta <anilgupta84@gmail.com>
Date: Tue, 1 Jul 2014 22:16:07 -0700
Message-ID: 
 <CAF1+Vs_D8gL6gJRb6aeuf+9GUTkNoGRmWENPeMK55awm9936Hw@mail.gmail.com>
Subject: Re: problem access security hbase
To: "user@hbase.apache.org" <user@hbase.apache.org>
Content-Type: multipart/alternative; boundary=001a11c3bfde90630304fd2efe87

--001a11c3bfde90630304fd2efe87
Content-Type: text/plain; charset=UTF-8

Hi Cheney,

If you are using a java client and using kinit way to login then i don't
have much idea about handling long running clients.
We run long running clients using UserGroupInformation to login to cluster.
I dont know the very specifics but it think there is a kerberos setting
where you can setup in such a way that Ticket auto-renews. We run this
client ranging from 2-4 weeks without any problem of security. Hope this
helps.

Thanks,
Anil Gupta


On Tue, Jul 1, 2014 at 7:12 PM, Cheney Sun <sun.cheney@gmail.com> wrote:

> Thanks Gary, Anil.
>
> Add this statement 'UserGroupInformation.setConfiguration(hbaseConf);' can
> resolve the problem.
>
> I'm using the kinit way to login KDC. But I wonder if I switch to calling
> UserGroupInformation.loginFromKeytab() in code, does it need to be
> called periodically for a long running program, since the TGT obtained from
> KDC will expire?
>
> Thanks,
> Cheney
>
>
> On Wed, Jul 2, 2014 at 1:20 AM, Gary Helmling <ghelmling@gmail.com> wrote:
>
> > Hi Cheney,
> >
> > Did you obtain kerberos credentials before running your program, either
> by
> > calling kinit before running the program, or by calling
> > UserGroupInformation.loginFromKeytab() in your code?
> >
> >
> > On Tue, Jul 1, 2014 at 8:44 AM, Cheney Sun <sun.cheney@gmail.com> wrote:
> >
> > > Hello all,
> > >
> > > I have setup a security hbase/hdfs/zookeeper, which was confirmed and
> > work
> > > normally.
> > > I wrote a Java program to get/put data to a table and package the
> > > core-site.xml / hbase-site.xml (which are obtained from the secure
> > cluster)
> > > into the jar file, and it worked correctly.
> > >
> > > But when I removed the core-site.xml and hbase-site.xml from the jar,
> and
> > > instead, I use the Configuration API to set the relevant settings in
> the
> > > program as below,
> > > Configuration hbaseConf = HBaseConfiguration.create(hadoopConf);
> > > hbaseConf.set("hbase.zookeeper.quorum","slave-nodex");
> > > hbaseConf.set("hbase.zookeeper.property.clientPort", "2181");
> > > hbaseConf.set("hbase.rpc.engine",
> > > "org.apache.hadoop.hbase.ipc.SecureRpcEngine");
> > > hbaseConf.set("hbase.security.authentication", "kerberos");
> > > hbaseConf.set("hbase.master.kerberos.principal", "hbase/_
> HOST@HADOOP.COM
> > > <HOST@HADOOP.QIYI.COM>");
> > >
> hbaseConf.set("hbase.master.keytab.file","/etc/hbase/conf/hbase.keytab");
> > > hbaseConf.set("hbase.regionserver.kerberos.principal", "hbase/_
> > > HOST@HADOOP.COM <HOST@HADOOP.QIYI.COM>");
> > >
> > >
> >
> hbaseConf.set("hbase.regionserver.keytab.file","/etc/hbase/conf/hbase.keytab");
> > > hbaseConf.set("hadoop.security.authentication", "kerberos");
> > > hbaseConf.set("hadoop.security.authorization", "true");
> > >
> > > It failed getting authenticated to access to the hbase with the error
> > > message as:
> > > org.apache.hadoop.ipc.RemoteException: Authentication is required
> > > at org.apache.hadoop.hbase.ipc.HBaseClient.call(HBaseClient.java:1021)
> > > ~[test-0.0.1-SNAPSHOT-jar-with-dependencies.jar:na]
> > >  at
> > >
> > >
> >
> org.apache.hadoop.hbase.ipc.SecureRpcEngine$Invoker.invoke(SecureRpcEngine.java:164)
> > > ~[test-0.0.1-SNAPSHOT-jar-with-dependencies.jar:na]
> > > at com.sun.proxy.$Proxy7.getProtocolVersion(Unknown Source) ~[na:na]
> > >
> > > It looks like the settings through API in code doesn't work. Is is a
> > known
> > > issue or am I wrong somewhere?
> > >
> > > Thanks,
> > > Cheney
> > >
> >
>


-- 
Thanks & Regards,
Anil Gupta

--001a11c3bfde90630304fd2efe87--